#RoningLoader - Twitter Hashtag

6 months ago

DragonBreath (APT-Q-27) targets Chinese-speaking users with a modified gh0st RAT variant focused on crypto and gaming VPNs since 2022. AttackIQ’s RoningLoader emulation aids detection and testing. #China #RoningLoader #APTQ27 https://t.co/pSTUjVtLMD

0

4

1

4

494

SolidSnake @soolidsnakee

6 months ago

You can checkout our #research here https://t.co/lOyHNGA0E8 Signed drivers, thread pool injections and some ppl abuse 😄 #malware #roningloader #ppl #threat

ANY.RUN

@anyrun_app

6 months ago

👾 #RoningLoader is a malware posing as Microsoft Teams. Once inside, it breaks business defenses and deploys #gh0stRAT as the next stage ❗️ Read a full SOC report to stop attacks on your company early: https://t.co/tCPwtBgluQ

anyrun_app's tweet photo. 👾 #RoningLoader is a malware posing as Microsoft Teams.

Once inside, it breaks business defenses and deploys #gh0stRAT as the next stage ❗️

Read a full SOC report to stop attacks on your company early: https://t.co/tCPwtBgluQ https://t.co/fmGhZVjDdn

0

33

13

10

7K

1

26

5

7

4K

ANY.RUN

@anyrun_app

6 months ago

👾 #RoningLoader is a malware posing as Microsoft Teams. Once inside, it breaks business defenses and deploys #gh0stRAT as the next stage ❗️ Read a full SOC report to stop attacks on your company early: https://t.co/tCPwtBgluQ

0

33

13

10

7K

Sathwik Ram Prakki @PrakkiSathwik

8 months ago

#DragonBreath #APT targets #Cambodia ផ្លាស់ផ្តូរការកំណត់ត្រូវបានជូនដំណឹង.lnk ed4e50299bd0c59e9f741c948e5d57ee Snegreijsmaity_1.exe #NSIS 73a84cba28d14625441e1b0eac2a67f1 #gh0stRAT #RoningLoader DiamondAge vmservice.sys #C2 202.95.11.173:5552

PrakkiSathwik's tweet photo. #DragonBreath #APT targets #Cambodia

ផ្លាស់ផ្តូរការកំណត់ត្រូវបានជូនដំណឹង.lnk
ed4e50299bd0c59e9f741c948e5d57ee

Snegreijsmaity_1.exe #NSIS
73a84cba28d14625441e1b0eac2a67f1

#gh0stRAT #RoningLoader
DiamondAge
vmservice.sys

#C2
202.95.11.173:5552 https://t.co/KKAA8ohA9T

Elastic Security Labs

@elasticseclabs

11 months ago

#ElasticSecurityLabs uncovers #RONINGLOADER, a multi-stage loader utilizing signed drivers, PPL abuse, CI Policies, and other evasion techniques to deliver #DragonBreath's gh0st RAT variant. Check it out at https://t.co/Df8JLO6w4d

elasticseclabs's tweet photo. #ElasticSecurityLabs uncovers #RONINGLOADER, a multi-stage loader utilizing signed drivers, PPL abuse, CI Policies, and other evasion techniques to deliver #DragonBreath's gh0st RAT variant.

Check it out at https://t.co/Df8JLO6w4d https://t.co/5jIdVG6unf

4

231

78

118

70K

1

28

10

13

3K

Racco42 @Racco42

10 months ago

Few #roningloader samples: https://t.co/uD6mCzrURQ https://t.co/8qHVZVFhXW https://t.co/maGiDDKuxa

1

2

0

421

Yaniv Radunsky @hasamba

11 months ago

Elastic: RONINGLOADER campaign uses signed driver ollama.sys and PPL (ClipUp) abuse to disable Microsoft Defender, plus custom WDAC rules and thread-pool injection; final payload is an updated gh0st RAT tied to DragonBreath. #RONINGLOADER #PPL #WDAC https://t.co/V12BuzrDvn

0

2

1

0

253

Andrew Pease @andythevariable

11 months ago

#RONINGLOADER -> PPL abuse, the new hotness.

Elastic Security Labs

@elasticseclabs

11 months ago

#ElasticSecurityLabs uncovers #RONINGLOADER, a multi-stage loader utilizing signed drivers, PPL abuse, CI Policies, and other evasion techniques to deliver #DragonBreath's gh0st RAT variant. Check it out at https://t.co/Df8JLO6w4d

4

231

78

118

70K

0

31

6

17

5K

Elastic Security Labs

@elasticseclabs

11 months ago

#ElasticSecurityLabs uncovers #RONINGLOADER, a multi-stage loader utilizing signed drivers, PPL abuse, CI Policies, and other evasion techniques to deliver #DragonBreath's gh0st RAT variant. Check it out at https://t.co/Df8JLO6w4d

4

231

78

118

70K

Top Tweets for #RoningLoader

Last Seen Hashtags on Sotwe

Trends for you

Most Popular Users